github intel/cve-bin-tool v3.3
CVE Binary Tool 3.3
on GitHub

latest releases: v3.4.1rc0, v3.4, v3.4rc3...
17 months ago

Release highlights

  • GSoC 2023 contributor @Rexbeast2 added support for EPSS scores to help users assess vulnerability risks (more info : https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html#metric)

  • GSoC 2023 contributor @b31ngd3v has set up a github action (available here: https://github.com/intel/cve-bin-tool-action) and did a lot of work related to using our new NVD mirror (available here: https://cveb.in/)

  • We now default to using our own NVD mirror unless an NVD_API_KEY is set.

    • The data is updated multiple times per day and duplicated to mirrors in several countries across the globe. They should be significantly faster than getting data from NVD directly, especially if you need to populate a database from scratch.
    • Mirroring infrastructure is provided by FCIX Software Mirrors, who currently provide a large portion of the global mirroring for linux distributions and other open source projects.
    • If you have difficulties with the mirrors or wish us to activate a mirror closer to you (we're only using a fraction of the servers available), please file an issue https://github.com/intel/cve-bin-tool/issues
    • These mirrors can be used in other tools or as part of research. We'd love to know if and how you use them!

  • Breaking Change: Windows users will now need to use python 3.12 if they want to scan tarfiles.

    • Testing has been disabled on windows for python < 3.12. It's likely that older versions of python will continue to work on Windows as long as you don't need tarfile support, but our binary checker tests use tarfiles so we can no longer run the full test suite.

  • We now provide our own version compare function, which will not be limited to PEP 440 compliant semantic versions.

  • Thanks especially to @ffontaine we are up to 359 binary checkers!

  • Our fuzz testing has been improved to cover more of our language file parsers. Thanks especially to @joydeep049, @mastersans , @raffifu and @inosmeet for their work in setting these up and fixing errors found via fuzzing.

We've also got a large number of new contributors, many of whom participated in Hacktoberfest 2023 or the first part of GSoC 2024, as well as users and security experts who were generous enough to share their time and expertise with us outside of these open source beginner-focused programs. Thank you!

Change Log

List of pull requests merged (quite long)

Full Changelog: v3.2.1...v3.3

New Contributors

Check out latest releases or
releases around intel/cve-bin-tool v3.3

Don't miss a new cve-bin-tool release

NewReleases is sending notifications on new releases.

Get notifications